System and method of modifying policy settings in an electronic device

ABSTRACT

The present invention provides a system and method of modifying policy settings in an electronic device. An embodiment includes a plurality of access stations, each capable of wirelessly transmitting across a geographic region. A mobile electronic device, capable of roaming between regions is operable to establish a wireless link with the access stations. The device is owned by an office which sets communication policies determining through which access stations mobile device can place voice calls. This policy is stored on an office server as a database and periodically transmitted to the device as the device makes contact with the office server over the internet. Hence, the device maintains a copy of this policy database. When placing a voice call, the device first determines which access station is serving the region it is located in and then determines whether it is allowed to place a call through that access station using its policy database.

FIELD OF THE INVENTION

The present invention relates generally to wireless telecommunicationand more particularly to a system and method for modifying policysettings in an electronic device.

BACKGROUND OF THE INVENTION

Mobile electronic devices (MEDs) capable of computing, informationstorage and communications are increasingly becoming commonplace. MEDstypically integrate the functions of personal information managementsuch as calendaring, data communications such as e-mail and world wideweb browsing and telecommunications into a single device. Research InMotion Limited of Waterloo, Ontario, Canada, and PalmOne, Inc. ofMilpitas, Calif. USA are two examples of manufacturers of such enhancedwireless electronic devices, and each offer a variety of products inthis category.

A typical MED contains a communications interface for establishingwireless communications with telephony and data networks servingdifferent geographic regions. In addition a typical MED contains amicrocomputer which controls most of the functionality of the MED andaids in processing of information that the MED is presented with.

As part of its functionality, a MED is called upon to establishcommunications with a network through many different network accessstations as the user of the MED roams through different geographicregions served by different network access station wireless carrier.Typically, each MED has a designated “home” region served by a “home”wireless carrier. All other regions are roaming regions. Thecharacteristics of services provided when a MED accesses a networkthrough its home region, as opposed to through a roaming region. Suchservice differences can include reduced connection security, reducedavailability of certain types of communications such as bandwidth fordata communications, and increased connection fees known as roamingcharges. Moreover, the differences in service depends on the roamingregion through which a connection is made. For example, availability ofdigital connections can vary from region to region.

Variability of service between the home region and the roaming regionscan present a significant problem to MED users or employers who pay forthe services on behalf of such users. Typically, a user who wants toestablish secure connections or avoid roaming charges, for example,monitors his or her location and uses wireless communication only in theroaming regions where secure connections are offered or where no roamingcharges are incurred. This requires a knowledge of the geographic regioncovered and services offered by the each network. Moreover, employerspaying for user's services, unlike users, have no way of monitoringindividual MED locations and hence rely on individual user's vigilancein order to ensure secure connections or avoid roaming charges.

SUMMARY OF THE INVENTION

It is an object of the present invention to provide a novel system andmethod for secure access that obviates or mitigates at least one of theabove-identified disadvantages of the prior art.

An aspect of the invention provides a subscriber device comprising aninterface operable to conduct communications over a link with at leastone base station in each of a plurality of geographic regions. Thedevice also includes a microcomputer connected to the interface that isoperable to maintain a policy associated with each region. The policydefines whether communications between the interface and the at leastone base station are permitted for each region. The microcomputerpermits the interface to communicate in accordance with the policy.

The communications can include a plurality of different services. Theservices can include at least one of voice, emails, internet browsingand text messaging.

The policy can permit one type of service to be performed in onespecific region, while disallowing another type of service in the samespecific region.

The policy can disallow communications in a particular region if thecommunications within the region are conducted over an insecure link, orare otherwise insecure.

The policy can disallow communications in a particular region if thecommunications within the region are conducted over an insecure link, orare otherwise insecure.

The policy can disallow the communications in at least one of theregions if a financial cost for conducting the communications exceeds apredefined threshold.

The links can include wireless links that can be based on one or more ofCDMA, OFDM, AMPS, GSM, GPRS, bluetooth, infra-red and 802.11.

The links can include wired links that can be based on Ethernet; USB;Firewire and RS-232.

Another aspect of the invention provides a method of conductingcommunications from a subscriber device comprising the steps of:

-   -   i) establishing a link with a base station from the subscriber        device;    -   ii) receiving an identifier from the base station at the        subscriber device;    -   iii) determining whether communications with the base station        are permitted based on the identifier; and,    -   iv) conducting the communications from the subscriber device        only if the communications are permitted according to said        determining step.

Another aspect of the invention provides a server for communicating witha plurality of subscriber devices comprising a microcomputer operable tomaintain a policy defining whether communications between at least onesubscriber station and at least one base station are permitted. Theserver also an interface for delivering the policy to each of the atleast one subscriber device.

Another aspect of the invention provides a computer readable mediaoperable to store a set of programming instructions. The programminginstructions are for operating a server that is for communicating with aplurality of subscriber devices. The programming instructions areexecutable on a microcomputer associated with the server. Theprogramming instructions are for rendering the microprocessor operableto maintain a policy defining whether communications between at leastone subscriber station and at least one base station is permitted.

Another aspect of the invention provides a computer readable mediaoperable to store a policy for storage in a subscriber station. Thepolicy defines whether communications between the subscriber station anda particular base station are permitted.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will now be described by way of example only, and withreference to the accompanying drawings, in which:

FIG. 1 is a block diagram of a system for modifying communication policyin accordance with an embodiment of the invention;

FIG. 2 is a block diagram of the mobile electronic device of FIG. 1;

FIG. 3 is a block diagram of certain internal components of a mobileelectronic device of FIG. 1;

FIG. 4 is a flowchart depicting a method of updating information inaccordance with an embodiment of the invention;

FIG. 5 is a flowchart depicting a method of establishing communicationaccording to policy in accordance with an embodiment of the invention;

FIG. 6 is another arrangement of the system of FIG. 1;

FIG. 7 is a block diagram of a system for modifying communication policyin accordance with another embodiment of the invention; and

FIG. 8 is a block diagram of a system for modifying communication policyin accordance with an embodiment of the invention.

DETAILED DESCRIPTION OF THE INVENTION

Referring now to FIG. 1, a wireless communication system in accordancewith a first embodiment of the invention is indicated generally at 30.System 30 comprises a plurality of access stations 34 operable towirelessly transceive across a variety of geographic ranges 38. In apresent embodiment, station 34, transceives across a first geographicrange 38 ₁, station 34 ₂ transceives across range 38 ₂ and station 34 ₃transceives across geographic range 38 ₃. Access stations 34 communicatewirelessly over a plurality of links 42. More specifically, station 34 ₁covers first geographic range 38 ₁ by transmitting and receiving signalsthrough link 42 ₁, station 34 ₂ covers second geographic range 38 ₂through link 42 ₂ and base station 34 ₃ covers third geographic range 38₃ through link 42 ₃. Access stations 34 are operated by differentwireless carriers 46. For example, stations 34 ₁ and 34 ₃ are operatedby wireless carrier 46 ₁, whereas station 34 ₂ is operated by wirelesscarrier 46 ₂. In a present embodiment, system 30 is based on a knownvoice-based wireless telecommunication such as Global System for MobileCommunications (“GSM”) or Advanced Mobile Phone System (“AMPS”).

In system 30, access stations 34 are also connected to a network 50 andnetwork 54 through a wired connection. In this embodiment network 50 isthe public switched telephone network (“PSTN”) and network 54 is theInternet, but in other embodiments other types of networks can beemployed.

System 30 also includes a mobile electronic device 58. Device 58 isowned by office 62 and operated by persons associated with office 62. Aswill be described in greater detail below, device 58 is operable toconnect to network 50 via a station 34's link 42 each time device 58 islocated within a range respective to that access station 34. Forexample, whenever device 58 is located within geographic range 38 ₁,device 58 can connect to network 50 by linking with access station 34,through link 42 ₁, and whenever device 58 is located within geographicrange 38 ₂, device 58 can connect to network 50 by linking with station34 ₂ through link 42 ₂.

Various types of information can be communicated through a link 42,including voice communications, data communications, etc. In particular,links 42 each carry an wireless carrier identifier WID, that identifiesthe wireless carrier 46 operating the respective access station 34 thatcarries that particular link 42. For example, if device 58 is locatedwithin geographic range 381, or range 38 ₃ device 58 would receiveidentifier WID₁ through link 42 ₁. In addition, links 42 each carry anaccess station identifier AID₁ that identifies the access station 34that carries that particular link 42. For example, if device 58 islocated within geographic range 38 ₁, device 58 would receive identifierAID₁ through link 42 ₁. Furthermore, links 42 carry the phone number (orother unique identifier) associated with each device 58 that connectswith an access station 34. For example, if device 58 is located withingeographic range 38 ₁, station 34, would receive the phone number ofdevice 58 through link 42 ₁. Moreover, links 42 can be based on anynumber of different wireless communication formats such as analog ordigital depending on the type of wireless communication method used. Forexample, when station 34 employs GSM for wireless communication, link 42established by that station is a digital link. When station 34 employsAMPS for wireless communication, link 42 established by that station isan analog link. Unlike analog links, which send signals using acontinuous stream, digital links transmit the communications inpacketized bit streams. Digital links 42 based on GSM offer enhancedsecurity over analog links 42 based on AMPS. Interception andreconstruction of a digital link involves more highly specialized andexpensive equipment than an analog link. Moreover, digital links 42 canbe encrypted using methods such as stream ciphers, resulting in anencrypted communication between device 50 and access station 34. In thisembodiment link 42, is a digital link, whereas links 42 ₂ and 42 ₃ areanalog links. As such, link 42 ₁ is inherently more secure then links 42₂, and 42 ₃.

Referring now to FIG. 2, device 58 is shown in greater detail. Device 58is based on the computing environment and functionality of a personaldigital assistant with wireless voice telephony capabilities. However,it is to be understood that device 58 can be based on the constructionand functionality of any mobile electronic device that can be connectedto a wireless network as well. Such devices include cellular telephonesor laptops computers connected to wireless networks. In a presentembodiment, electronic device 58 includes, a housing 66, which frames anLCD display 70, a speaker 74, a microphone 78, a trackwheel 82, and akeyboard 86. Trackwheel 82 can be inwardly depressed along the path ofarrow “A” as a means to provide additional user-input. It will beunderstood that housing 66, can be made from any suitable material aswill occur to those of skill in the art.

Referring now to FIG. 3, a block diagram of certain internal componentswithin device 58 are shown. Device 58 is based on a microcomputer thatincludes a processor 90. Processor 90 is connected to a read-only-memory(“ROM”) 94, which contains a plurality of applications executable byprocessor 90 that enables device 58 to perform certain functions.Processor 90 is also connected to a random access memory unit (“RAM”) 98and a persistent storage device 102 which is responsible for variousnon-volatile storage functions of device 58. Processor 90 can sendoutput signals to various output devices including display 70 andspeaker 74. Processor 90, can also receive input from various inputdevices including microphone 78 and keyboard 86. Processor 90 is alsoconnected to a modem and radio 106. Modem and radio 106 are operable toconnect device 58 to wireless access stations 34 in range of device 58,in the usual manner, via an antenna 114.

Referring back to FIG. 1, office server 110 is a computing device, (suchas a personal computer, a server, or the like) that is typicallycomprised of hardware suitable for server type functions, and includes acentral processing unit, random access memory, hard-disk storage and anetwork interface for communicating over network 54. Office server 110stores the office connection policy (“CP”) database 118, used fordetermining which access stations 34 a device 58 can link with in orderto connect to a network. Table I shows the initial settings of anexample CP database 118 of office 62 for device 58 when it attempts toconnect to network 50, namely when a wireless voice call is being made.TABLE I Example record of a CP Database 118 of Office 62 Record # 1Field 2 Field 1 Access Field 3 Device Station Policy for IdentifierIdentifier Voice Calls 555-555- AID₁ Allow 5555 Communication AID₂ AllowCommunication AID₃ Allow CommunicationTable I shows one record, labelled Record 1, which reflects informationcorresponding to device 58. It should now be apparent that database 118can include additional records for any additional devices 58 that areincluded in system 30.

Describing Table I in greater detail, Field 1 contains the uniqueidentifier of device 58, in this case its phone number “555-555-5555”.Field 2 contains a list of unique identifiers, AID₁ associated withaccess stations 34. Field 3 contains the communications policy of office62 for each access station 34, in this case simply the decision toeither “Allow Communication”, or “Disallow Communication”. In this casea communication is allowed through access stations AID₁, AID₂ and AID₃.(It should now be apparent that other communications policies (ratherthan “allow” or “disallow” communication) can be stored in CP databases118, and 122. For example, the communication policy stored may be tolimit the length of the call when device 58 is in range of some accessstations and allow limitless calls when in range of others. It shouldalso be apparent that a combination of policies can also be used.)

By the same token, device 58 also includes CP database 122 that includesdata corresponding to the information stored in CP database 118. Theinitial settings of CP database 122 are shown in Table II. TABLE IIExample of a CP Database 122 of Device 58 Field 1 Access Field 2 StationPolicy for Identifier Voice Calls AID₁ Allow Communication AID₂ AllowCommunication AID₃ Allow CommunicationField 1 of database 122 corresponds to Field 2 of database 118, andField 2 of database 122 corresponds to Field 3 of database 118. Becauseinitially, when the user first acquires the device from office 62,device database 122 has the same content as the office database 118.

The policy, as described by CP database 118, is set by office 62 andupdated by office 62 from time to time as needed. For example, office 62may desire that device 58 should place wireless calls through network 50only when a digital link is available between an access station 34 anddevice 50 to reduce the chances that the wireless portion of the call isintercepted. According to this policy office 62 would not want device 58to connect to network 50 through access stations 34 ₂ or 34 ₃ sincestations 34 ₂ 34 ₃ only provide an analog link 42 ₂ 42 ₃ based on AMPSwhich is highly susceptible to interception. Thus, policy database 118would be updated to reflect the new policy as shown in Table III. TABLEIII Example record of an Updated CP Database 118 of Office 62 Record # 1Field 2 Field 1 Access Field 3 Device Station Policy for IdentifierIdentifier Voice Calls 555-555- AID₁ Allow 5555 Communication AID₂Disallow Communication AID₃ Disallow CommunicationNotice that Field 3 associated with AID₂ has been changed to “DisallowCommunication” to reflect the new policy that device 58 should notconnect to network 50 through access station 34 ₂.

At this point device database 122 no longer contains the same policiesas office database 118. Office 110 is operable to update CP database 122of device 58 by communicating with device 58 when device 58 connects tonetwork 54.

Referring to FIG. 4, a method for updating policy database 122 isindicated generally at 200. In order to assist in the explanation of themethod, it will be assumed that method 200 is operated using system 30,and that device 58, as shown in FIG. 1, is located in range 38 ₁.Furthermore, the following discussion of method 200 will lead to furtherunderstanding of system 30 and its various components. (However, it isto be understood that system 30 and/or method 200 can be varied, andneed not work exactly as discussed herein in conjunction with eachother, and that such variations are within the scope of the presentinvention).

Referring back to FIG. 4, at step 210 a link is established. As anexample of how step 210 can be performed, device 58 establishes link 42₁ with station 34 ₁ which is serving the range 38 ₁. Moving to step 220,a connection is made with an office server. Continuing with the example,when step 220 is performed device 58 will use link 42, established atstep 210 to connect to network 54, and through network 54, willeventually make a connection to office server 110.

Method 200 will then advance from step 220 to step 230, at which pointthe new policy is transferred. Continuing with the example, database 122is updated by transferring the new policy to device 58. The updated CPdatabase 122 is shown in Table IV. TABLE IV Example of an Updated CPDatabase 122 of Device 58 Field 1 Access Field 2 Station Policy forIdentifier Voice Calls AID₁ Allow Communication AID₂ DisallowCommunication AID₃ Disallow Communication

To summarize the example, database 122 originally held the contents ofTable II, but upon performance of method 200 using the specific example,database 122 now holds the contents of Table IV. Thus, a policyadministered from office 62 has remotely changed base stations 34 thatare accessible by device 58 from all access stations 34 down to accessstation 34 ₁.

Referring now to FIG. 5, a method for placing a wireless call throughnetwork 50, according to CP database 122, is indicated generally at 300.In order to assist in the explanation of the method, it will be assumedthat method 300 is operated using system 30 and that device 58, as shownin FIG. 1, is located in range 38 ₁. Furthermore, the followingdiscussion of method 300 will lead to further understanding of system 30and its various components. (However, it is to be understood that system30 and/or method 300 can be varied, and need not work exactly asdiscussed herein in conjunction with each other, and that suchvariations are within the scope of the present invention.)

Referring back to FIG. 5, at step 310 a link is established. As anexample of how step 310 can be performed, device 58 establishes link 42₁ with station 34 ₁ which is serving range 38 ₁. Moving to step 320, anidentifier is received. Continuing with the example, when step 320 isperformed device 58 receives the identifier associated with an accessstation 34. In this case, the identifier is AID₁ which is the identifierof access station 34 ₁.

Method 300 then advances from step 320 to step 330, at which point adetermination is made as to whether communication is permissible. Inthis example, the office policy is examined to determine whethercommunications through access station 34 ₁ are permitted. To performthis step, device 58 examines the office policy regarding wireless callsassociated with identifier AID₁ in CP database 122. In this case, thepolicy associated with AID₁ is “Allow Communication”. Accordingly, step350 is performed next and communication is established. Accordingly, inthis example, device 58 places a wireless call through network 50.

Referring to FIG. 6, device 58 now moves to range 38 ₂, served by accessstation 42 ₂. In order to place a wireless call using device 58,according to CP database 122, method 300 is performed a second time.

Referring back to FIG. 5, at step 310 a link is established. As anexample of how step 310 can be performed during this second performanceof method 300, device 58 establishes link 42 ₂ with station 34 ₂ whichis serving range 38 ₂. Moving to step 320, an identifier is received.Continuing with the example, when step 320 is performed device 58receives the identifier associated with access station 34. In this case,the identifier is AID₂ which is the identifier of access station 34 ₂.

Method 300 then advances from step 320 to step 330, at which point adetermination is made as to whether communication is permissible. Inthis example, the office policy is examined to determine whethercommunications through access station 34 ₂ are permitted. To performthis step, device 58 examines the office policy regarding wireless callsassociated with identifier AID₁ in CP database 122. In this case, thepolicy associated with AID₂ is “Disallow Communication”, as shown inField 2 of Table IV. Accordingly, step 340 is performed next andcommunication is not permitted. Accordingly, in this example device 58is prevented from placing a call.

Referring now to FIG. 7, a system for secure access in accordance withanother embodiment of the invention is indicated generally at 30 a.System 30 a is substantially the same as system 30, and like elements insystem 30 a bear the same reference as like elements in system 30,except followed by the suffix “a”. System 30 a differs from system 30 inthat in system 30 a different policy databases are used.

In this embodiment, office 62 a desires that device 58 a place wirelesscalls through network 50 a only using wireless carrier 46 a ₁ sincewireless carrier 46 a ₁ offers cheaper connections than other carriers46 a. According to this policy, office 62 a would not want device 58 ato connect to network 50 a through access station 34 a ₂ since station34 a ₂ is operated by wireless carrier 46 a ₂. CP database 118 areflecting this policy is shown in Table V. TABLE V Example record of anUpdated CP Database 118a of Office 62a Record # 1 Field 2 Field 1Wireless Device Carrier Field 3 Identifier Identifier Policy 555-555-WID₁ Allow 5555 Communication WID₂ Disallow CommunicationNotice that Field 3 associated with WID₂ is set to “DisallowCommunication” to reflect the new policy that device 58 a should notconnect to network 50 a through wireless carrier 46 a ₂. Such a policythat limits communications according to carrier could be desired for anumber of reasons, such as reducing or controlling roaming charges, suchthat a particular device 58 a can only perform communications in a homeregion. Other criteria for setting policies that reside in device 58 awhich define access stations 34 a that are accessible to device 58 awill now occur to those of skill in the art.

By the same token, device 58 a also includes a CP database 122 a thatincludes data that corresponds with the information stored in connectionpolicy database 118 a. Contents of CP database 122 a is updated byperforming method 200, shown in FIG. 4 in substantially the same manneras database 122 in system 30. The updated CP database 122 a is shown inTable IV. TABLE VI Example of an Updated CP Database 122a of Device 58aField 1 Wireless Field 2 Carrier Policy for Identifier Voice Calls WID₁Allow Communication WID₂ Disallow Communication

Referring back to FIG. 7, device 58 a is in range 38 a ₂, served byaccess station 42 a ₃. In order to place a wireless call using device 58a, according to CP database 122 a, method 300 is performed.

Referring back to FIG. 5, at step 310 a link is established. As anexample of how step 310 can be performed, device 58 a establishes link42 a ₃ with station 34 a ₃ which is serving range 38 a ₃. Moving to step320, an identifier is received. Continuing with the example, when step320 is performed device 58 a receives the identifier associated withwireless carrier 46 a. In this case, the identifier is WIDa₁ which isthe identifier associated with wireless carrier 46 a ₁, operating accessstation 34 a ₃.

Method 300 then advances from step 320 to step 330, at which point adetermination is made as to whether communication is permissible. Inthis example, the office policy is examined to determine whethercommunications through access stations operated by wireless carrier 46 a₁ are permitted. To perform this step, device 58 a examines the officepolicy regarding wireless calls associated with identifier WIDa₁ in CPdatabase 122 a. In this case, the policy associated with WIDa₁ is “AllowCommunication”, as shown in Field 2 of Table VI. Accordingly, step 350is performed next and communication is established. Accordingly, in thisexample, device 58 a places a wireless call through network 50 a.

Referring now to FIG. 8, a system for secure access in accordance withanother embodiment of the invention is indicated generally at 30 b.System 30 b is substantially the same as system 30, and like elements insystem 30 b bear the same reference as like elements in system 30,except followed by the suffix “b”. System 30 b differs from system 30 inthat in system 30 b all links 42 are digital and that different policydatabases are used.

In system 30 b office 62 b employs CP database 118 b which issubstantially the same as CP database 118 but has additional fields usedfor determining which access stations 34 b a device 58 b can link within order to connect to different networks when using differentapplications (e.g. voice calls, web browsing, and e-mail). For example,an additional field is used for determining which access stations 34 b adevice 58 b can link to in order to connect to e-mail through theInternet (network 54 b). A further field is used for determining whichaccess stations are linkable for surfing the web through the Internet(network 54 b). Table VII shows an example of database 118 b of office62 b for device 58 b. TABLE VII Example record of a Connection PolicyDatabase 118b of Office 62b Field 5 Field 2 Field 4 Policy for AccessField 3 Policy for E- Web-surfing Field 1 Station Policy for mailThrough Through The Device Identifier Identifier Voice Calls TheInternet Internet 555-555- AID₁ Allow Allow Disallow 5555 CommunicationCommunication Communication AID₂ Allow Allow Disallow CommunicationCommunication Communication AID₃ Allow Disallow Allow CommunicationCommunication CommunicationTable VII shows one record, labelled Record 1, which reflectsinformation corresponding to device 58 b. It should now be apparent thatdatabase 118 b can include additional records for any additional devices58 b that are included in system 30 b, or additional fields foradditional applications available on device 58 b.

Describing Table VII in greater detail, Fields 1 through 3 contain thesame information as CP database 118, shown in Table I. Field 4 containsthe communications policy of office 62 b for each access station 34 b,in this case simply the decision to either “Allow Communication”, or“Disallow Communication”, to be used when device 58 b attempts to checke-mail through network 54 b. In this case, device 58 b can only checke-mail when connected to network 54 b through access stations 34 b ₁ and34 b ₂. Note also that device 58 b is permitted to place voice callsthrough any of the access stations 34 b.

Continuing with the description of Table VII, Field 5 contains thecommunications policy of office 62 b for each access station 34 b, inthis case simply the decision to either “Allow Communication”, or“Disallow Communication”, to be used when device 58 b attempts to surfthe web through network 54 b. In this case device 58 b can surf the webonly through access stations 34 b ₃. (It should now be apparent thatother communications policies (rather than “allow” or “disallow”communication) can be stored in CP databases 118 b, and 122 b. Forexample, a communication policy may limit the data bandwidth when device58 b is in range of some access stations 34 b and allow limitlessbandwidth when in range of others. It should also be apparent that acombination of policies can also be used.)

Device 58 b also includes a CP database 122 b that includes data thatcorresponds with the information stored in connection policy database118 b. CP database 122 b is updated by performing method 200, shown inFIG. 3 in substantially the same manner as CP database 122 in system 30.The updated CP database 122 is shown in Table VIII. TABLE VIII Exampleof a CP Database 122b of Device 58b Field 4 Field 1 Field 3 Policy forAccess Field 2 Policy for E- Web-surfing Station Policy for mail ThroughThrough The Identifier Voice Calls The Internet Internet AID₁ AllowAllow Disallow Communication Communication Communication AID₂ AllowAllow Disallow Communication Communication Communication AID₃ AllowDisallow Allow Communication Communication Communication

Field 1 of database 122 b corresponds to Field 2 of database 118 b,Field 2 of database 122 b corresponds to Field 3 of database 118 b,Field 3 of database 122 b corresponds to Field 4 of database 118 b andField 4 of database 122 b corresponds to Field 5 of database 118 b.

Referring back to FIG. 8, which gives an example arrangement, device 58b is range 38 b ₁, served by access station 34 ₁. When device 58 battempts to access e-mail, method 300 is performed again to determinethe permissibility of the e-mail access. Performance of method 300 usingsystem 30 b is substantially the same as the performance of method 300using system 30 except that Field 3 of database 122 b is used todetermine the policy as opposed to using Field 2 to determine the policyfor voice calls. In this example, the e-mail policy associated withaccess station 34 b, (as identified by AIDb₁) is to allowcommunications. Thus, device 58 b will be able to access e-mail. Whendevice 58 b attempts to surf the web, on the other hand, performance ofmethod 300 will disallow access to the web since the policy associatedwith web surfing in region 38 ₁ (specified by the first row of Field 4of Table VIII) is to disallow communication.

While only specific combinations of the various features and componentsof the present invention have been discussed herein, it will be apparentto those of skill in the art that subsets of the disclosed features andcomponents and/or alternative combinations of these features andcomponents can be utilized, as desired. For example, although GSM andAMPS are wireless communication methods contemplated, it should now beapparent that other wireless communication methods such as the CodeDivision Multiple Access (“CDMA”) for digital connections and the TotalAccess Communication System (“TACS”) for analog connections are allwithin the scope of the invention. Other methods include General PacketRadio Service (“GPRS”), and Orthogonal Frequency Division Multiplexing(“OFDM”), amongst others.

In another variation, database 122 in system 30 can be updated through adirect connection between device 58 and office server 110. It should nowbe apparent that this direct connection can take the form of a wiredconnection such as a Universal Serial Bus (“USB”) connection, across-linked peer to peer Ethernet connection, or a wireless connectionsuch as a Bluetooth connection, an infrared (IR) connection, or a peerto peer IEEE 801.11 (e.g. 802.11b, 802.11g or other 802.11 variants)connection. In yet another variation, database 122 could be updatedthrough a Local Area Connection (“LAN”) to which both device 58 andoffice server 110 are connected.

In another variation, different criteria other than location of device58 can be used for enabling, disabling or otherwise varying thecommunication capabilities of device 58. For example, time can be usedas a determinant of communication capabilities. Accordingly, device 58and certain applications performing on device 58, such as e-mail, couldbe allowed to communicate during certain periods of time such asdaytime, and certain other applications, such as voice calls, could beable to communicate during other time periods such as night time. Thesepolicies can be designed, for example, to take advantage of periodsduring which certain services are offered at reduced costs by wirelesscarriers. Thus, office 62 can set up a policy database 118 which allowsvoice calls only during evenings and weekends when voice calls arecheaper. As another example, policies can be set up to choose betweendifferent wireless carriers when each region is served by multiplecarriers. So, for example, if a region 38 is served by 2 access stations34, device 58 can determine which access station to use consulting thecommunications policy (namely during the performance of method 300).Accordingly, when there is a choice of carriers, policies could bedesigned to select more secure, less expensive or otherwise moredesirable wireless carrier over those carriers that are less secure,more expensive or otherwise less desirable.

In yet another variation, device CP database 122 could be updated usingdifferent methodologies. For example, the transfer of CP database 118could be made selectively, transferring the database only when adifference is found between CP database 118 and 122. It should now beapparent that a variety of different methods could be employed fordetermining a difference. For example, each field of database 118 can becompared to the equivalent fields in database 122 to determine whetherthere are any differences. Alternatively, sizes of the database files orthe date of modification of these files could be compared. Moreover, thecomparison can be done either by office server 110, device 58 or someother computer trusted with maintaining synchronized CP databasesbetween the office and the roaming devices. All these methods, and othermethods for determining whether a CP database should be transferred todevice 58 are within the scope of this invention.

In other variations, the policy can be stored in forms other than adatabase such as a lookup table. Moreover, the policy can be stored at acomputer other than the office server. For example, the policy can bestored on routers and other dedicated computing devices. Also, thepolicy could be stored on a computer or other electronic device which isoperated by an entity other than the office that operates the mobiledevices.

While portions of the foregoing description may individually referencesystems 30, 30 a, 30 b and 30 c, it should now be apparent that all orparts of each of these systems can be combined as appropriate orotherwise desired. Accordingly, those of skill in the art will recognizethat when certain references are made to one of these systems, and/orits components, such teachings can also be applicable to other ones ofthose systems.

The above-described embodiments of the invention are intended to beexamples of the present invention and alterations and modifications maybe effected thereto, by those of skill in the art, without departingfrom the scope of the invention which is defined solely by the claimsappended hereto.

1. A subscriber device comprising: an interface operable to conductcommunications over a link with at least one base station in each of aplurality of geographic regions; and, a microcomputer connected to saidinterface and operable to maintain a policy associated with each saidregion; said policy defining whether communications between saidinterface and said at least one base station are permitted for each saidregion; said microcomputer permitting said interface to communicate inaccordance with said policy.
 2. The device of claim 1 wherein saidcommunications include a plurality of different services.
 3. The deviceof claim 2 wherein said services include at least one of voice, emails,internet browsing and text messaging.
 4. The device of claim 2 whereinsaid policy permits one of said services in a specific region anddisallows another one of said services in said specific region.
 5. Thedevice of claim 1 wherein said policy is disallows said communicationsin at least one of said regions if said communications within saidregion are insecure.
 6. The device of claim 1 wherein said policy isdisallows said communications in at least one of said regions if a costfor conducting said communications exceeds a predefined threshold. 7.The device of claim 1 wherein said links include wireless links that canbe based on one or more of CDMA, OFDM, AMPS, GSM, GPRS, bluetooth,infra-red and 802.11.
 8. The device of claim 1 wherein said linksincludes wired links that can be based on Ethernet; USB; Firewire andRS-232.
 9. A method of conducting communications from a subscriberdevice comprising: establishing a link with a base station from saidsubscriber device; receiving an identifier from said base station atsaid subscriber device; determining whether communications with saidbase station are permitted based on said identifier; and, conductingsaid communications from said subscriber device only if communicationsare permitted.
 10. The method of claim 9 wherein said communicationsinclude a plurality of different services.
 11. The method of claim 10wherein said services include at least one of voice, emails, internetbrowsing and text messaging.
 12. The method of claim 10 wherein saiddetermining step includes determining whether one of said services in aspecific region associated with said base station is allowed.
 13. Themethod of claim 10 wherein said determining step policy disallows saidcommunications with at least one of said base stations if communicationswithin said base station are insecure.
 14. The method of claim 10wherein said determining step is disallows said communications in atleast one of said regions if a cost for conducting said communicationsexceeds a predefined threshold.
 15. The method of claim 9 wherein saidlink is a wireless link based on one or more of CDMA, OFDM, AMPS, GSM,GPRS, bluetooth, infra-red and 802.11.
 16. The method of claim 9 whereinsaid link is a wired link based on Ethernet; USB; Firewire and RS-232.17. A server for communicating with a plurality of subscriber devicescomprising: a microcomputer operable to maintain a policy definingwhether communications between at least one subscriber station and atleast one base station is permitted; and, an interface for deliveringsaid policy to each of said at least one subscriber station.
 18. Acomputer readable media operable to store a set of programminginstructions; said programming instructions for operating a server thatis for communicating with a plurality of subscriber devices; saidprogramming instructions executable on a microcomputer associated withsaid server; said programming instructions for rendering saidmicroprocessor operable to maintain a policy defining whethercommunications between at least one subscriber station and at least onebase station is permitted.
 19. A computer readable media operable tostore a policy for storage in a subscriber station; said policy definingwhether communications between a subscriber station and said at leastone base station are permitted.